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Shor's algorithm for factoring in polynomial time on a quantum computei^ gives an enor- 
mous advantage over all known classical factoring algorithm. We demonstrate how to factor 
products of large prime numbers using a compiled version of Shor's quantum factoring al- 
gorithm. Our technique can factor all products of p, q such that p, q are unequal primes 
greater than two, runs in constant time, and requires only two coherent qubits. This illus- 
trates that the correct measure of difficulty when implementing Shor's algorithm is not the 
size of number factored, but the length of the period found. 

1 Introduction 

Building a quantum computer capable of factoring larger numbers than any classical computer 
can hope to is one of the grand challenges of computing in the 21st century. While still far off, 
there have already been several small-scale demonstrations of Shor's algorithrcP^. Someday soon 
a quantum computer may factor a number hitherto unthinkably large. Such a device would most 
likely have to be a fully scalable fault-tolerant quantum machine, capable of carrying out any task 
a quantum computer could be asked to do. Thus, a large factorization would be convincing proof 
that one has built a practical quantum computer. Until such a time, more modest goals must suffice. 
The experiments mentioned above have factored numbers no larger than 21. Here we will show 
how current technology can demonstrate significantly larger factorizations. 

We begin with a review of Shor's algorithm. Given an integer N = pq with p, q distinct 
primes, one proceeds as follows: 



1 . Choose (at random) an integer < a < A^. 

2. Compute the greatest common divisor (GCD) of a and A^. This can be found efficiently 
using the Euclidian algorithnP. If it is not 1, then GCD(a, A^) is a nontrivial factor of A^. 
Otherwise go on to the next step. 

3. Choose 8 = 2'' such that N'^ < S < 2N'^. Construct the quantum state 
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Figure 1 : Circuit for Shor's algorithm using the semi-classical quantum Fourier transform. At each 
stage a |+) state is prepared. It is used as the control input on a controlled unitary t/^" ^ for the nth 
bit of the readout, with U\y) = \ay mod N). Next, the gate V^^ = Q is applied and then the 
qubit is measured. H = \ {\^^ is the Hadamard gate and the phase is computed as a function 
of all previous measurement results (see Ref.^). The first time there is no phase so the Hadamard 
is used. The process is repeated n times to read out n bits of precision of the Fourier transform. 



on two quantum registers, the first is s-qubits and the second is log qubits. Note that in 
the literature x and a sometimes have their meanings interchanged. 

4. Perform a quantum computation on this state which maps \x) |0) to \x)\a^ mod A^). This is 
the slowest step, but can be done in time 0((log A^)^). 

5. Do the quantum Fourier transform on the first register, resulting in the state 

S-^ e('"'/^)"^|l/)|a" mod A^) . (2) 

X y 

This step requires 0((log A^)^) time, which is much less than the modular exponentiation of 
the previous step. 

6. Measure the first register to obtain classical result y. With reasonable probability, the con- 
tinued fraction approximation of y/S or some y' / S for some y' near y will be an integer 
multiple of the period r of the function mod A^. The GCD algorithm can then efficiently 
find r. 

7. If r is odd, or if a^/^ = — 1 mod A^, go back to step 1. Otherwise, GCD(a''/^ ± 1, A^) is p 
or q. 



Significant optimization of the basic algorithm has been achieved. As described, roughly 
3 log A^ qubits are needed. In fact, this can be reduced down to exactly 2 + 3/2 log A^ qubits'''. A 
significant part of the reduction is to replace the first "x" register with a single qubit. This was 
shown to be possible''''^' and uses the fact that the bits of the quantum Fourier transform can be 
read out one at a time^. The use of this semi-classical Fourier transform has become known as 
qubit recycling. A circuit using qubit recycling is shown in Fig. [TJ 
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Figure 2: The circuit for the fully-compiled Shor's algorithm. The modular exponentiation is the 
single controUed-NOT, and the quantum Fourier transform is a Hadamard gate. 

2 Compiled Shor's Algorithm 

All experimental realizations of Shor's algorithm to date have relied on a further optimization, that 
of "compiling" the algorithm. This means employing the observation that different bases a in the 
modular exponentiation lead to different periods of the function mod A^. Some of the periods 
are both short and lead to a factorization of the composite pq. 

In 2001, the composite 15 was factored^ using two different bases, an "easy" base (a = 11, 
resulting in a period of 2), and a "difficult" base (a = 7, with a period r = 4). Neither is fully 
general and this allowed the factorization to take place on a seven bit quantum computer, when the 
best known uncompiled algorithm would require 8 bits (2 + 3/2 log A^ bits as per Zalkdi%. Other 
factorizations of 15 have since been performed using other architecture^^^. More recently, 21 
has been factored^ using just one qubit and one qutrit (a three-level system). In this case a = 4 is 
used, resulting in a period r = These results are summarized in Table 1. 

Recently, Zhou and Geller showecP^how to find a's with small periods for products of Fermat 
Primes^"^ (primes of the form 2^ + 1). Here, we go substantially beyond this idea and show that any 
composite number pq has compiled versions of Shor's algorithm that can be run on a very small 
quantum computer. In particular, we show that there always exists a base a such that r = 2. Then, 
the second register need only hold two distinct states and the computation can be performed using 
only two qubits. In this case, the U needed in the circuit from Fig. [T]reduces to a controUed-NOT 
gate. Furthermore, only one stage of the circuit is required since all powers of U"^" are the identity 
except for n = 0. The compiled circuit is shown in Fig. [2} 



In order for the second register to need to hold only two distinct states, we must find a base 

*Note that Shor's algorithm normally fails when r is odd since a^^^ is irrational in general. Here, since a = 4 is a 
perfect square, this problem does not arise. 
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Table 1: Number of qubits required for Shor's algorithm and experimental results. RSA-768 and 
N-20000 are available in the supplementary material. Quantum version to be completed. Classical 
version with one random bit has been performed, see Section [3} 
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Figure 3: Experimental data from unbiased coins, (a) A 1998 US quarter was tossed 10 times to 
factor 15. (b) A 1968 US penny was tossed 20 times in order to factor RSA-768. (c) A 2008 US 
Oklahoma commemorative quarter was tossed 20 times to factor N-20000. One-cr error bars are 
shown. 

a such that = 1 mod pq. The Chinese remainder theoremPl tells us that 

0^ = 1 mod pq <^ = 1 mod p and = 1 mod q (3) 

for p, q relatively prime. By construction 

a = ±ppq ± qqp has = 1 mod p and = 1 mod q (4) 

where Pg is the multiplicative inverse of p, mod q and qp is the inverse of q, mod p. Then ([3]) 
tells us = 1 mod pq. These inverses can be found efficiently using the extended Euclidian 
algorithm. There are 4 solutions of Q corresponding to the signs. Two of these will be trivial, 
±1 and the other two will be bases resulting in compiled Shor factorizations with a period of the 
function mod having period 2. 
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3 Experiment 

A future version of this preprint will include experimental data using two superconducting transmorP' 
qubits. In the meantime, we perform a simpler experiment. We employ a further optimization not 
used in previous experiments. Observe that in the circuit in Figure [2[ the second qubit is never 
measured. In fact, what is created by the controUed-NOT is a maximally-entangled state, half of 
which is simply discarded. The resulting state of the first qubit is therefore maximally mixed. Due 
to the unitary equivalence of purifications, if we create a maximally mixed state in any way at all, 
it is entangled with some system in the environment. A maximally mixed state is unaffected by the 
Hadamard gate, so this too is unnecessary. We can therefore produce the appropriate probability 
distribution at the output by tossing an unbiased coin. Fig. [3] shows the data for factoring 15, 
RSA-768, and N-20000 using this method. 

4 Conclusions 

Of course this should not be considered a serious demonstration of Shor's algorithm. It does, how- 
ever, illustrate the danger in "compiled" demonstrations of Shor's algorithm. To varying degrees, 
all previous factorization experiments have benefited from this artifice. While there is no objec- 
tion to having a classical compiler help design a quantum circuit (indeed, probably all quantum 
computers will function in this way), it is not legitimate for a compiler to know the answer to the 
problem being solved. To even call such a procedure compilation is an abuse of language. 

As the cases of RSA-768 and N-20000 suggest, very large numbers can be trivially factored if 
we were to allow this. For this reason we stress that a factorization experiment should be judged not 
by the size of the number factored but by the size of the period found. Current experiments ought to 
be viewed instead as technology demonstrations, showing that we can manipulate small numbers 
of qubits. In Ref.^, for instance, it was shown that intentionally added decoherence reduced the 
contrast in the data, a hallmark of a quantum-coherent process. All the referenced experiments 
are important tiny steps in the direction of building a quantum computer, but actually running 
algorithms on such tiny experiments is a somewhat frivolous endeavor. 
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6 Supplementary material 

We have factored RSA-768: 

RSA - 768 =1230186684530117755130494958384962720772853569595334792197322 
4521517264005072636575187452021997864693899564749427740638459 
2519255732630345373154826850791702612214291346167042921431160 
2221240479274737794080665351419597459856902143413 
=3347807169895689878604416984821269081770479498371376856891243 
388982883793878002287614711652531743087737814467999489 
X 3674604366679959042824463379962795263227915816434308764267 
6032283815739666511279233373417143396810270092798736308917 

which can be done using 

a =1029031793302493258003488818376905875264575120178567995715921117383374 
0637809554762657146559655560974877155097084531342124720712415517107376 
6764612501767199553731974973903504534358652759946682893508255761840004 
7627481255809299529939 or 

a =2011548912276244971270061400080568455082784494167667964814013347683523 
3672630818125303054623423037190224096523432092963345312131577459271606 
3902143490245030584823163722635383870725074621773650339655236462265303 
792116204047602613474. 

We have also factored N-20000: 

N - 20000 =3545872995518995320162216211194750088254004994975476505069782010092562 

6836455218077570931827645265231608998412594091501169267869932212762643 
7952340916754401101694942393398796986114303891110264606442388558651298 
8969181675291250725852835615290690458331490854580449715364904882361230 
3234271985470197470205533036194402979614663510505596285870603463725841 
3294436223612733881541244957256787578366712932408954804647829260155941 
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1444057806766879951233726684092407204779854854431536554954640444167496 
3844339791512553551092864281417298489668114677339033398078956576863772 
6354676678753024806722863674385802601319484610034919950211309093009540 
5949579561782282227038687651707862691988512957531427525039477044137682 
2111920721522148087696432046839747743667973894759586729469351498803425 
8962044592322773864737596716914996302081975587285523928985393001093345 
3532923398023447380352816430049211499186658152360647169892936850272053 
0977920879248353643585686181315512898374697516865004762004956941084908 
8691670020716296801864932328763094256328083479904065324168359574206973 
2449257885376492437902211127107636812954877711352430874473152262662092 
1393167409565204821691194551281949537731218793132259214278948500148983 
3344871961435511910047360734736812014832840402983502352620746227654188 
4821175368994484765461270105712673387687224075345896614234794751348388 
4010462683805164134781712394881679848878483404785832664176081990699296 
6948006619580318497838879486674968615405796077696761351965322716784614 
7871304649614628515620902547289543420206114653340656249551468555247381 
8240712032875920730690848056307144691354557092267705269040098564622603 
2392695881701195013830935107656843989911154471193950278950107730349221 
4291514924457659248459718543654416911772236786502398286527705256699729 
7748537137527061667330019454152656165205315539492875423667810539723325 
7022274282342200952354298403423449776728858821486783470468226452695002 
9965935276141786952752454295813011211063314171867861464423084956383254 
9250134337994353366719174074821153482037985373069187708394252853900085 
4621063052758727903887688129106643403113169705619311899904858481305060 
6794594308020321189052847966275370327401680437045200772702267192976527 
8022092616552738346118012463149731620383592103183116018168719777412966 
4680141180854170139904809370511462062235669898350272862689886145264779 
0432452754012715374184451464019524311183243733549609931901183953471741 
9682604800709871547108871240628342851823772296896287863147378366801691 
4146092518979691440024256035159221892354831540906789710253791305057945 
2513618763200501337192664729579391825335186059463895910648093389943606 
9023498084198924775533135861627217005509336538759667215543315715133914 
6545373118930562292794711875572014653533038100140905439252036847724360 
4084047742325464019428788002314216269103442810812782163053880781848891 
0976756747825489367195795173775440332520928104948661596841414261882855 
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0508084652551183976898343978994771023762438504588172953877252482623051 
5919224994427013165388804662115091908342462138499805129411607905132572 
4944127375531074567010781507626054608117591697601660015955369691615690 
7299677384025069458631358698179643840467067437522628304697721524957084 
5459564669588865188810573355621573095176830937715876692732697106901427 
4380431733357921633228621406293959828148048345567080697512994682036864 
2273953787724284705267144103683177203987376883047129500494898696824232 
9532558731137573475789782578092773219041672171778789766725155223594083 
7800940240714338777859756549429556992790225005076766692433272372515832 
5468083394216073893463198581373135761145571139995993471008944898117555 
7915110867759507303536690925541985870318508355007476077608513903304792 
3425828007998127685805726212734915981827589500867306063576535238956394 
6793395313450971874893873569704161228657978315778567085288463502009723 
9226270256866094212840482256101905075703352067871310155247660290496318 
4692638571607375563996900070807339193161786801869496736152219039495203 
5125269783067194766221272323906814360475290868630208923012179164036085 
9837356438242466155230648491979782175513982312032742419908008157043521 
0580254128091700530671326828205445719642746517340874658991929885960264 
7517647709753226504353677801754694678666697336302625047413771645854127 
0547527549069602306014337414254789438208964165690841775476825804165152 
5304663247060964001143198123077855794438185702605450833342983353775818 
5889572134166889296081487694243723204621491394952553741414901724430252 
8855616909378500458286429434922098019136721665788293210513458527694013 
2216643750671547230453049952426398499419053393702254349492760414472993 
0642315675678036189230393221614960576525703335669945041027365152055579 
5744126705024976289705383585305834157781770550223289305932646500163282 
0116464325733138774212045809506632783143002474700159635962123125236917 
4409101844438736437858315266946108779141151800556377477506707469599007 
3102992317593007543603235409748865074021408056842928974647832116695824 
5583057892303965553619740076982226149049986747523605054240483216161269 
5845735514152275026785133897200124109426854987571162068144453489055014 
5864970551342995682354407222447173109382329057323719589044948028095133 
4711147625611503091127337452960350812003389806489437389335138585299176 
8503183902737153079057664904077587776062549909997744891283441109343053 
9710212166551627117192070283735855586679692418134287944889037963176608 
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8271018129029021585609464256357290486028253978413567783992747663703346 
4998930738742796686640128620923272630180172545665881974962283565208378 
8146895814608717113146637672212361020062046644744553178935511572078813 
4289685668894167388898155080721001862530295759444117033443834883115100 
0650673799192981407882986789587653580546902745162832189506923934649727 
3468283522712516205990343243813973588848694703996512441662433168667879 
1132220512140731023345171452862842540349609656231516812698183384579682 
7082647120785562227006525356718270612869805415804935095162605716061024 
4348906073326891005641611113422562155003437331976928597724313112437132 
9726226175793616722507421635694278871177878800928003913785632249721075 
9 

=1920007954675520804378850214567096264456508253959234467727111623305767 
7374265185330406795304487914263190662072636603750445244958319471906305 
0546199924938408954543563150180797425730245513649150981962229175055926 
5639970111115853501252719600314314117110756537592110376119248953599128 
3899768868030610997197057941193788301384925356840915526630432721419360 
4879721566536637493968167315831870622227408193652848736544484648059007 
8879203308810158844503374309748890063940900027992536261993320143970650 
4546707853810288254711599606525009903719426231146990556873785020501023 
6921309632407499531263607144034119343854298380373180935294905206027753 
3316164523654367390074206381449205517815424087196134280305359588385106 
0148885682715175492354454895919496808226041535676588909998629212717595 
7252045335576196896285685325032772197585932310039602104286674497751751 
3735511346429161240577093834733605413619341789239569628496964487858741 
9397025118511173835678856918497340476843981151822753936393438415284562 
2595327259462749546191534394708028267948168734606287494477015179631963 
3128988988026887797548866985684538406348675891721165893482443941143046 
9198897765504664490525671701566860302600604994891420505724328362982218 
5869500891998443885693582489052192339402286011515307511936291172078611 
5369435318064427753875206862604881427693151447822040695630536054475353 
3757533602651731156682480712806900803919574751471016869541117827746736 
5536021391516685181241161433621755613145667340298230128682616323239082 
3357619809691615460088802326462712010390810975054420845793817460736705 
2466388857583094796671645765497531297255387079830529056697297735365569 
8272054576608357098630860329108094169459004787030168446544659938078598 
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5561989769518993444500177834799824245748273057983371486640604699710487 
4770533916896193700019269730005874534486128087333932120639645595377582 
1046929424126942165409602171262376117287841141661522578005357658615376 
9418694236300911166268868347387404024568881764404915174437824364735237 
0193628308367963132731910962182993571571649918139994774563087499048797 
4894318231809141370840393798152696022983479657048672802741548348653208 
7256329064122941199182695807446254219961505997352333010564207142241119 
8854298777617828048368908767864646729247705615907317577720222897361292 
2113013794638075033833008149473852130731813326482758226200609938833244 
6141896781756368023768571213708719369689067047153100989591494973353316 
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